Effective date: 4 August 2026

This Privacy Policy explains how WISAL AL MASI ESTABLISHMENT FOR INFORMATION TECHNOLOGY ("WESSAAL", "we", "us") collects, uses, stores, shares, and protects personal data when customers and users access WESSAAL Cloud and related WESSAAL services.

1. Who controls your data

For account administration, security, billing, direct customer support, and WESSAAL’s own operational purposes, WISAL AL MASI ESTABLISHMENT FOR INFORMATION TECHNOLOGY acts as the data controller.
For contacts, campaign data, message content, templates, recipient selections, and other information uploaded or configured by a customer through WESSAAL Cloud, the customer is generally the controller and WESSAAL acts as its processor, subject to the applicable agreement and customer instructions.
Privacy and legal contact: info@wessaal.com.

2. Personal data we process

Account and identity data, such as name, email address, phone number, country, profile information, and account settings.
Authentication and security data, such as login history, IP address, device and browser information, sessions, tokens, and security events.
Subscription and billing data, such as plan, entitlements, invoices, payment status, amount, currency, transaction references, refunds, and consent records. WESSAAL does not intend to store raw payment-card data.
Workspace and access data, such as organization or workspace details, members, roles, permissions, resource identifiers, and usage information.
WESSAAL Cloud communication data, such as contacts, recipient numbers, lists, templates, message or media content, campaign configuration, consent or opt-out status, and delivery or failure metadata.
Support and diagnostic data, such as support requests, error information, and minimum technical logs needed to operate, secure, and troubleshoot the service.

3. Why we process data

Create, verify, secure, and administer accounts.
Provide WESSAAL Cloud and customer-requested messaging, campaign, and automation functionality.
Manage subscriptions, billing, invoices, and payments.
Send service, security, billing, and support communications.
Prevent fraud, misuse, unauthorized access, and security incidents.
Operate, troubleshoot, protect, and improve the service.
Comply with applicable law, enforce agreements, and establish, exercise, or defend legal claims.
Support customer marketing communications only where the customer has the required lawful basis, recipient authority, and consent where applicable.

4. Meta and WhatsApp Business Platform

WESSAAL Cloud may integrate with Meta’s WhatsApp Business Platform to allow customers to connect WhatsApp business accounts, manage approved messaging capabilities, and send or receive communications through enabled features.
Customers are responsible for complying with applicable law and Meta/WhatsApp policies, including requirements concerning recipient consent, opt-in, message content, templates, and opt-out handling.
When Meta or WhatsApp services are used, certain account, messaging, technical, and delivery information may be processed by Meta under Meta’s applicable terms and privacy policies.

5. Service providers and international processing

WESSAAL may use hosting, email, monitoring, payment, messaging, and infrastructure providers to operate and protect the service. These may include DigitalOcean, Hostinger, Sentry, Moyasar, Meta / WhatsApp Business Platform, and other approved technical providers.
Depending on the enabled service and provider, personal data may be processed or backed up outside Saudi Arabia.
WESSAAL applies appropriate contractual, technical, organizational, and access-control safeguards as required by applicable law.

6. Retention and deletion

We retain personal data only for as long as necessary to provide the service and meet legal, contractual, accounting, security, fraud-prevention, and dispute-resolution requirements.
Operational account data may be deleted or anonymized following a verified deletion request, except where retention is required by law or necessary for legitimate legal, security, fraud, accounting, or dispute purposes.
Backups expire according to applicable backup-retention cycles.

7. Your rights

Subject to applicable law and WESSAAL’s role, you may request information about processing, access to your personal data, a readable copy, correction, deletion or destruction where permitted, withdrawal of consent where processing relies on consent, and complaint handling.
Requests may be submitted to info@wessaal.com. We may verify identity before processing a request and may route customer-controlled data requests to the relevant customer when that customer is the controller.

8. Security

WESSAAL uses administrative and technical safeguards intended to reduce unauthorized access, loss, alteration, disclosure, and misuse, including access controls, secret management, encryption in transit, monitoring, backups, and incident-response procedures.
No online service can guarantee absolute security.

9. Customer responsibilities

Customers using WESSAAL Cloud are responsible for having lawful authority to process uploaded data and contact recipients.
Customers must obtain required opt-in or consent, honor opt-out requests, avoid spam, deceptive, harmful, or unlawful communications, and comply with Meta and WhatsApp policies.
Customers are responsible for protecting their accounts, credentials, authorized users, and workspace permissions.

10. Children and higher-risk contexts

WESSAAL Cloud is primarily intended for business organizations.
Customers using the service in connection with minors, health information, education, or other higher-risk contexts must obtain all required authority, notices, consents, and approvals and comply with applicable law.

11. Changes and contact

We may update this Privacy Policy from time to time. The current version and effective date will be published on this page.
Privacy and legal questions or complaints should be sent to info@wessaal.com